Support disconnect_expired_cert for database access

[smallinsky]

Issue #5476

Purpose:

Add support for the client_idle_timeout and disconnect_expired_cert user role flags in the client db proxy connection.

Implementation:

Use Monitor object to track connection activity.

[r0mant]

@smallinsky Also, please cover this scenario (disconnecting expired cert and, if possible, idle timeout) with unit tests. See test files in srv/db package for examples, most of the machinery for spinning up dbs should already be there. We also have integration tests in integration/db_integration_test.go.

[r0mant]

Implementation looks good to me now, just a few suggestions/nits here and there.

[r0mant]

@smallinsky I've just realized something - the way it's currently implemented, with the connection being monitored on the proxy only, won't cover the trusted cluster scenario.

With trusted clusters, connection goes from the root cluster proxy to leaf cluster database service. So we need to have the same connection monitor on the "database service" side as well (lib/srv/db/server.go).

[r0mant]

Can we unexport sync.RWMutex and net.Conn? You can also just remove net.Conn completely probably and just use it from cfg.

[smallinsky]

yes, the mtx can be unexpected but net.Conn uses struct embedding in order to implement all unnecessary net.Conn methods and unexported net.Conn will require explicitly implementation of net.Conn methods like RemoteAddr SetWriteDeadline by theTrackingReadConn struct.

[smallinsky]

@r0mant

I've just realized something - the way it's currently implemented, with the connection being monitored on the proxy only, won't cover the trusted cluster scenario.

hm, I'm wondering if monitoring root proxy conn in leaf db service is needed.

Right now in trusted cluster scenario we have following setup:

db client -----> root proxy -------> leaf db service -> db
         (conn monitor) 

As far I know the root proxy ---> leaf db connection depends on db client - > root proxy and in case of idle connection termination by root proxy the root proxy -------> leaf db service connection will be also terminated.

Am I missing something ?

[smallinsky]

@r0mant
I have added connection monitor to db service and covered the trusted cluster idle timeout scenario by integration test.

[nklaassen]

Code looks good to me

[r0mant]

Mostly lgtm, just one question about integration tests.